VSFTPD
I recently spun up a centos 6.0 box and decided to go threw the strokes of setting it up as a bonified webserver. The installation was easy opening the correct ports was not. A quick summery of what I did:
Step 1: installed vsftpsd with sudo yum install vsftd
Step 2: I modified the vsftpd.conf file to include some settings -
first I made sure that anonymous connections weren't allowed anonymous_enable=NO
then I set ftp users to be "jailed" to there home directory and pointed to a file of users that I do not want to "jail" (I also created an empty chroot_list in the specified location) chroot_local_user=YES chroot_list_enable=YES chroot_list_file=/etc/vsftpd/chroot_list
this locked down vsftpd to use predictable passive ports pasv_min_port=3000 pasv_max_port=3050
if you were given a default conf file you probably can just scroll through it to uncomment out these lines.
Step 3: Once that was finished I fired up vsftpd with sudo service vsftpd start
Step 4: Now I had to punch a whole into my firewall to open the ports that vsftpd uses. I first opened up vsftpd's default listening port(21) with sudo iptables -I INPUT -p tcp --dport 21 -j ACCEPT then I had to open the passive ports that I configured in the conf file(3000 to 3050) with sudo -I iptables -I INPUT -p tcp --dport 3000:3050 -j ACCEPT
Step 5: By default my iptables was set to not save on restart, you can modify this in /etc/sysconfig/iptables-config by setting the option IPTABLES_SAVE_ON_RESTART="no" to yes, I do not do this in case I mess up my fire wall settings I can just restart with sudo service iptables restart. But since I haven't messed anything up (yet) i need to save my current iptables with sudo service iptables save. Now if I restart my box or restart my iptables these ports will still be open.
Step 6: Now I needed to create a user to test with so I created a user sudo useradd -g users testftp then sudo passwd testftp, then used the password ftp. Fired up my favorite ftp client dropped in my credentials and was jailed to my home directory. Good Job for the night.
I did some additional testing to with an unjailed user. Soon I want to see if I can add additional access to other directories, IE if a user works on a website to have access to that directory as well as their home. Not sure if thats possible but I will find out one way or another.
















